Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Free anti-ransomware utility, what would you recommend?

Apr 28, 2017 5:33PM PDT

Hello,

My question relates to ransomware. I try to follow best practices when it comes to ransomware. I do not open email attachments when I'm not absolutely sure they are legitimate (going so far as to call / email the "senders" - if I recognize them as friends - to verify they actually sent the mail). I take daily, incremental backups of my computer and store them on a NAS device (I know - many ransomware variants will encrypt the NAS device too). And, in addition to my anti-virus program, I use an anti-ransomware product to help mitigate the risks.

I'd like to hear opinions from your readers on what they consider the best *FREE* anti-ransomware product. I don't have a sandboxed environment where I can safely test ransomware threats to see if my defenses would be effective, and I'm hoping some of your readers have done extensive research on the subject. I have at some point used the anti-ransomware products from Malwarebytes, BitDefender, and Cyberreason. I have not tried Kaspersky's tool yet. Thank you!

-Submitted by Jack E.

Discussion is locked

- Collapse -
Re: appsamvid
May 5, 2017 6:51PM PDT

I'll have to check that out. It may be safe but it sounds like a step back into the bad old days of intrusive Vista UAC.

- Collapse -
Testing
May 6, 2017 2:34PM PDT

I testing the Vista Parental Control whitelist on my honey pot machine, and found it worked very well. I can't vouch for the newer OS, but it wasn't intrusive at all, and when it did occasional pop up for verification, I'd simply give it the administrative password and OK the file action, if it were a legitimate process.

- Collapse -
Extra Browsing Protection, my 2 cents...
May 5, 2017 7:22PM PDT

There are a couple of things we use here at MATRYX Systems ourselves and setup for out clients. These will help block sites and more.
And both have free options.
OpenDNS
www.opendns.com/
Some really great message settings for in house support.
This link is to a .pdf I created a few years back with OpenDNS setup info:
www.matryxsystems.com/download/An_Extra_Layer_of_Security.pdf
K9 Web Protection
www1.k9webprotection.com/
This is a good one for home users.
Both have great configuration options, messaging, etc. And are easy to setup.

Links disabled by moderator.

Post was last edited on May 6, 2017 2:56 PM PDT

- Collapse -
Re: Browsing protection
May 5, 2017 8:46PM PDT

LOL. You're taking me way back...

I installed K9 on my home computers when my kids were still growing up. Let's just say I wasn't the most popular dad in the neighborhood - my kids had to go to their friends' homes to misbehave. I still recommend K9 to clients who would rather give their children administrative access (rather than limited accounts) but want them to have some level of protection. My kids, now grown, use K9 to limit what their children can do on the web!

As far as OpenDNS (or any of the other "curated" DNS options), those would certainly help somewhat to avoid internet-based threats, but there are so many people now who share content through USB sticks, and I wanted something that would protect against local threats as well.

- Collapse -
Cloud storage with versioning
May 5, 2017 7:54PM PDT

Anything with a drive letter (and depending on malware, a unc path) can be attacked. That includes cloud connected live sync data, since it is being synced from a location on your hard drive. HOWEVER if you pick the right cloud provided, you can restore previous versions - so if your synced data gets encrypted by malware, you can restore a previous version using your cloud provider.

I use drop box personally, but google drive has better security and also provides versioning.

- Collapse -
Re: Mapped drives
May 5, 2017 8:53PM PDT

Your point about local drive mappings to networked drives is well-taken. My backup software allows me to specify UNC paths to my NAS. Combine that with the non-standard filetype extension, and so far, I've been sheltered from ransomware.

I don't use it at my own office, but for some of my business clients, I recommended commercial off-site backup solutions that I programmed to transfer (not sync) their "bare metal" backup files to the cloud.

- Collapse -
Encrypting File System
May 5, 2017 9:17PM PDT

Go to Control Panel/Administrative Tools/Services/Encrypting File System(EFS) ; right click, select Properties and set mode to Disabled.
With this disabled your files cannot be encrypted.

- Collapse -
Bad Advice
May 6, 2017 5:22AM PDT

This is very bad advice. Ransomeware rarely uses EFS for encrypting so it doesn't matter whether EFS is enabled or not. You can encrypt your files regardless of EFS (TrueCrypt for example). Infact Home versions of Windows don't have EFS anyway.

- Collapse -
anti-ransomware
May 6, 2017 6:19AM PDT
- Collapse -
Re: CryptoPrevent
May 6, 2017 10:40AM PDT

Thank you, willard32. I'll have to check that out!

- Collapse -
You beat me to it..
May 6, 2017 2:39PM PDT

now my posts are redundant - sorry folks! Sad

- Collapse -
Choose Sophos
May 6, 2017 6:50AM PDT

I at a Managed Service Provider and we recently switched our users from ESET to Sophos. In my professional opinion, it is one of the best decisions we've made due to how extensive the Sophos product is. They also make a Sophos Home version that gives you a lot of the same protection you would get from their business-class product including protection from viruses, malware, ransomware and others. I know I sound like an advertisement, but it's because I've seen what Sophos can do first-hand and they have impressed the hell out of me so far. One of the software products one of our customers uses tried to encrypt a legitimate folder for a software upgrade and Sophos blocked the encryption action. We were easily able to make an exception and move on with the installation. I have been very impressed with Sophos and use their Sophos Home for my laptop at home because I truly trust them with the protection of my computer.
https://home.sophos.com

- Collapse -
This works...
May 6, 2017 7:25AM PDT

Nothing is 100% guaranteed but here's what I recommend:
1. Use Chrome (not IE or Edge) with AdBlocker. You MUST install Adblocker. It prevents the pop-ups that slip through the browser's standard pop-up blocker.
2. Make sure you use Windows Defender. Its a free anti-virus protection from Microsoft and it's algorithms are constantly updated.
3. Do NOT open email attachments other than from KNOWN and TRUSTED sources. This is very very important as ransomware can be embedded in email file attachments. If you get and email saying "invoice" or "delivery" or anything else that looks out of the ordinary, DO NOT OPEN IT.
4. Make sure you have spam filters engaged on whatever email program you use. Outlook has it built in but you need to go into the settings and make sure it is set for "high" security.
5. Make sure you regularly backup your important files. Its a pain but it needs to be done.

- Collapse -
Free anti-ransomware utility
May 6, 2017 7:47AM PDT

Hello Jack; I'm using Cybereason RansomFree. Don't know if it does the job (yet) but it is highly rated an i forget but i believe CNet did a review on it. It's also free. Google it and have a look.

- Collapse -
Re: RansomFree
May 6, 2017 10:43AM PDT

Thanks, wysetech. That's what I'm using right now!

- Collapse -
Use common sense with your computer and don't be lazy
May 6, 2017 8:02AM PDT

Users have to learn to close a web page when in doubt.
Put spam or any other questionable email in a junk or spam folder so the address will be blocked permanently.
You might think you are on a safe page sometimes but when a window pops up saying this is Microsoft and we need to scan your computer for potential problems, close the page immediately.

I personally have a well known internet security program running all the time. Shut off your computer when not in use during the night or day for that matter. {Kaspersky Total Security]

I also use a separate outside utility that Cleans my browser and cleans my registry, I will let you guess what program that is. [CCleaner] Free - been using for years, wonderful. Use daily if possible.

I also use a utility that searches and destroys any issues such a spying. [Spy Bot Search & Destroy] Free version, look for the main site before downloading. Donate if you like. Also been using for years. Use monthly or more.

Over the years these common sense practices have never failed me.

You also have to watch out for Microsoft itself for they seek to find out everything you do, every minute of every day, it's up to you to prevent that the best you can. Yes Google is invasive too, I know that. I feel an operating system shouldn't know everything you do however, yes I understand their concept.

Checking your system weekly or daily is highly recommended.

- Collapse -
Re: Software titles
May 6, 2017 10:48AM PDT

Yeah, I figured out the names of your software from your first post - I thought you were being clever to avoid the posting of "advertisements".

- Collapse -
Passive protection..
May 6, 2017 3:17PM PDT

The good thing about Spybot and Spyware Blaster - both reviewed here on CNET - is that they use passive protection. They write web blockers into the browsers own security features and the registry, that protect against Active X, scripts or misbehaving sites. One of them uses a host file as well, to block bad sites. This uses NO CPU power, so can be very effective, and nip things in the bud before anything can happen. Be sure to set CCleaner not to clean site preferences for Mozilla Firefox, as this is how Spywareblaster blocks malicious sites.

People complain that thay are both long in tooth, and somehow obsolete, but you can't get much better than blocking things in this manner, as it acts just like real time protection, without any of the slow downs other solutions cause, and it really can't go obsolete as long as browser design remains as it is for now. I think the only reason to pay for SpywareBlaster is to get the automatic updates, so as long as you don't mind checking them manually on occasion, that won't be absolutely required.

Although they probably can't contain all the bad web sites out there, it is certainly easier to do that, than waste time with billions of definitions of malware and such!

- Collapse -
look at reviews of others 50+ above on items
May 6, 2017 11:12AM PDT

some of you may not know this:
when you get attack by ransomware basic it a flash file fool you or punk you! paying up!

Options: kill or remove ransomware basic close out any browser you may have running. then clean your item of it:
1.) (this is bit hard to do) go to your desktop, force close out (exit taskmanager) browser & restart it, click-on "X" tap fast, open go to browser history and clear it of data, you can leave cookies that be ok

2.) (easier to do) use CCleaner select all, clean it> done no reboot/ restart needed

cost totally free when you every get hit by ransomware i would use Ccleaner and keep it updated as will. its in App-stores free, free version will do the job, you can buy the pro version too.

there even Ccleaner for kindle's and Iphones, google phones as will to remove ransomware

as for Malwarebytes its not the rock on fighting ransomware! i got hit by it using Malwarebytes pro when it was running sad fact. Ccleaner is free to use and blow away ransomware! i still use Malwarebytes but as a backup scan for item may have leech into my system!

- Collapse -
Good advice..
May 6, 2017 3:27PM PDT

However, I don't recommend ever clicking on the [X] to close the browser or offending process, doing that can give the malware permission to do more damage - I recommend using task manager to end the process - or even better yet add process explorer to your tools to end pesky processes.

- Collapse -
Re: Flash File Hocus-Pocus
May 7, 2017 6:45AM PDT

There are several "popup" messages that try to tell you you're infected and invite you to call a phone number to get the problem removed. Many of those are fake, and I tell my clients to do a forced shutdown (power button on computer's case). Most times, the browser has been tampered with, but no actual damage has been done to the computer. Cleaning with tools mentioned above, as well as adwclearner and malwarebytes generally gets the job done.

- Collapse -
You Can't be Too Careful!
May 10, 2017 12:37PM PDT

We all have Macs in our family (across the US), and we all use Sophos and are happy with it so far. Before I use or buy anything, I check it out on Consumer Reports and on Epinions . com.
It's important to back up to a remote AND to a cloud. Please take the time to remove the remote drive when not in use, or the ransomeware and viruses, etc. will go directly on there too, so what good does that do? It's worth the extra effort, as those who got affected will testify! The cloud is great as its accessible from anywhere, even on vacation. We have a cloud, Box, Drop Box and a couple others for sharing between us.
Ever since a long-time friend of mine had a fire when she was gone and lost her computer and all her back up CD's and thumb drives and remote drives - losing everything but what was on her phone - to both the fire and the water to put it out, I've made sure I keep my largest back up drive either at my son's house across town or in our Safety Deposit Box at our nearby bank. Yes, it's a chore to go get that back home to use once a month, but well worth it. Smaller drives are nearby to use weekly or even daily if I want.
Meanwhile, always update everything, don't share passwords or equipment with ANYONE, and follow the recommendations about others on being careful on the web and with e-mails, etc.
Password protect everything with strong passwords. Do all you can. You just can't be too careful.